CVE-2025-37727
Fixed in a distro release EPSS <1%CVSS 5.7
Insertion of sensitive information in log file in Elasticsearch can lead to loss of confidentiality under specific preconditions when auditing requests to the reindex API https://www.elastic.co/docs/api/doc/elasticsearch/operation/operation-reindex
Products: Elasticsearch
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.elasticsearch.plugin:reindex-client | 8.18.8 |
| Maven | org.elasticsearch.plugin:reindex-client | 8.19.5 |
| Maven | org.elasticsearch.plugin:reindex-client | 9.0.8 |
| Maven | org.elasticsearch.plugin:reindex-client | 9.1.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | camunda-8.8 | 8.8.40-r0 |
| Chainguard | camunda-zeebe-8.6 | 8.6.39-r14 |
| Chainguard | camunda-zeebe-8.7 | 8.7.42-r1 |
| Chainguard | camunda-zeebe-8.8 | 8.8.40-r0 |
| Chainguard | commercial-elasticsearch-8.17 | 8.17.10-r2 |
| Chainguard | conductor | 3.31.0-r4 |
| Chainguard | conductor-fips | 3.31.0-r4 |
| Chainguard | elasticsearch-7 | no fix |
| Chainguard | elasticsearch-7-iamguarded | no fix |
| Chainguard | elasticsearch-8.17 | no fix |
| Chainguard | elasticsearch-fips-8.17 | 8.17.10-r14 |
| Chainguard | elasticsearch-fips-8.17-bitnami | 8.17.10-r14 |
| Chainguard | elasticsearch-fips-8.17-bitnami | 8.17.10-r7 |
| Chainguard | elasticsearch-fips-8.18-bitnami | 8.18.8-r5 |
| Chainguard | ranger | 2.9.0-r6 |
| Chainguard | ruby3.2-elasticsearch | 9.2.0-r0 |
| Chainguard | ruby3.3-elasticsearch | 9.2.0-r0 |
| Chainguard | ruby3.4-elasticsearch | 9.2.0-r0 |
| Ubuntu 16.04 LTS | elasticsearch | no fix |
| Wolfi | ruby3.2-elasticsearch | 9.2.0-r0 |
| Wolfi | ruby3.3-elasticsearch | 9.2.0-r0 |
| Wolfi | ruby3.4-elasticsearch | 9.2.0-r0 |